6 th imfo audit & risk indaba 20-22 april 2015 olive convention centre durban presented by: thoko...

6 TH IMFO AUDIT & RISK INDABA 20-22 APRIL 2015 OLIVE CONVENTION CENTRE DURBAN Presented by: Thoko Konyana

BACK TO BASICS THROUGH RISK MANAGEMENT Can Enterprise Wide Risk Management in the municipal environment improve the IDP planning?

Integrated Development Planning (IDP) Defined Risk Management Defined Risk Management in Strategy Setting (IDP) Challenges to Effective Risk Management Definition of Risk Culture Closing Remarks Questions

In 1995 the Forum for Effective Planning and Development (FEPD) defined Integrated development planning as: A participatory approach to integrate economic, sectoral, spatial, social, institutional, environmental and fiscal strategies in order to support the optimal allocation of scarce resources between sectors and geographical areas and across the population in a manner that provides sustainable growth, equity and the empowerment of the poor and the marginalised. Section 152 of the Constitution of the RSA (Act 108 of 1996): (1)The objects of local government are (a)to provide democratic and accountable government for local communities; (b) to ensure the provision of services to communities in a sustainable manner; (c) to promote social and economic development; (d) to promote a safe and healthy environment; and (e) to encourage the involvement of communities and community organisations in the matters of local government. (2) A municipality must strive, within its financial and administrative capacity, to achieve the objects set out in subsection (1).

Through Integrated development planning (IDP), a municipality can: Identify its key development priorities; Formulate a clear vision, mission and values; Formulate appropriate strategies; Develop the appropriate organisational structure and systems to realise the vision and mission; and align resources with the development priorities.

Risk Management is a process of thinking systematically about all possible undersirable outcomes before they happen and setting up procedures that will avoid, minimise or cope with their impact. What is Risk? A Risk is any event or occurrence that threatens an organisations ability to reach its objectives or its ability to survive. It is the possibility of incurring a loss or misfortune (or gain) as a result of a particular event (a threat (or opportunity) to the achievement of organizational objectives?) simply put WHAT CAN GO WRONG?

How does Risk relate to Strategy Setting (IDP)? Vision- Where to? Strategy- How to get from here to there (broadly)? Plan What to do/ actions and How to do it (Specific)? Risk- What can go wrong? How do we prevent or limit it? Risk Based Planning- How do we plan such that our plans have a reasonable chance of success, knowing what we know to be wrong or possible to go wrong in our business? Risk Management is the business of asking MANY questions, the responses or lack there-of is the main answer. It begins to tell you about what is wrong, and gives management an opportunity to look deeper and to eventualy come up with those answers that will serve to mitigate the risks.

Separating Strategic Risks from Operational Risks Getting the focus right in the IDP STRATEGIC RISKS Relate to activities that supports the organizations vision and mission The existence and continuity of the organization The Direction taken by the organization Decisions taken on a broad level (Executive) How the organization functions as a whole Continuation and sustaibility of Critical Services & Functions Organisational beliefs and Culture Leadership Style (From the Top) Developmental Outcomes Customer/ Community Satisfaction

OPERATIONAL RISKS Relates to Operations and How tos of day-to-day business Systems and Process undertaken to reach the organisations objectives People and Resources Performance and Service Delivery activities at specific levels of the organization (departmental) Outputs

Common challenges that make Strategic Risk Identification impossible? IDPs that have no defined Strategic Objectives that speak to The Vision & Mission or that expand on the intentions/ purpose of the KPAs IDPs that focus on operational deliverables that are process related as opposed to developmental priorities IDPs with KPIs that do not translate Socio-economic and other Stats into actionable priorities whereas the Risk Profile should be able to incorporate such risks on a broader scale. IDPs that do not indicate Service Delivery Backlogs, the Risk Profile can track the increasing risk exposure due to delayed improvements in backlogs

Which Critical Areas should they fail, THE INSTITUTION will Fail? Most Critical Pieces of the Puzzle Business Functions, Services, etc.?! The Risk Profile should address these risks and they should inform what goes in the IDP alongside other developmental priorities. How soon can these mitigation actions be in place (quantifying the consequences VS time lapse) Timing of implementation (Long term, Medium term, Short term) Are the mitigation actions realistic, adequate, effective and resourced? The Key is Anticipating and Preparing for the worst !

What can happen?When can this happen?Where can this happen?How can this happen?Why is it likely to happen?What will be the impact?Who will it impact?How can we prevent or limit this? How will we recover and continue to function should it happen?

IDP BUDGET SDBIP PERFORMANCE RISK IDENTIFICATION RISK FUNDING RISK MONITORING & REPORTING RISK MITIGATION/ IMPLEMENTATION RISK MANAGEMENT

IDP What can go wrong/ What is the risk? What informes the Strategy? Is the Strategy the right one? Is the Strategy implementable/ Do-able ? Is the implementation approach the right one? Will the Strategy bring about the desired outcome? Does it address the right issues? Will it succeed/ Can it work? Is it resourced? Are we doing the right things at the right time? Will it make a difference?

What should be the FOCUS for Risk Management in IDP planning? IDP & Risk State of the Economy State of the Communities (People) State of Service Delivery State of the Institution Applicable Legislation Cross- Cutting Issues (Inter- Sectoral Plans & Issues) Spatial Planning / Integration State of Environment 3.Is the Vision, Mission & Objectives informed by PAST experience and FUTURE expectations in these focus areas? 4.How are statistics interpreted as part of the IDP Planning? 5.Does the IDP respond timely to changes in the concerned areas? What is the risk if NOT? 1.What is the RISK (what can go wrong)? 2.Has a comprehensive assessment been done in these areas?

The Economy The Institution The Citizens/ Communities The Risk Profile of the Institution should address mainly theses 3 critical areas however not in isolation of the rest: What happens when the Economy declines progressively/ increasingly? What happens when the Institution declines progressively/ increasingly? What happens when the Communities decline progressively/ increasingly? Does the Risk Profile indicate: The Key Risks to the 3 The state- how good or bad? Actions in place to address deficiencies. Does the IDP take the Significant Risks of the 3 areas into account as part of ensuring sustainable development?

Risk Considerations in IDP Planning: PESTEL Political- Events include government elections and political mandates. Economic- Related to cost of capital, price movements/inflation, capital availability, etc. Social- Events include changing demographics, social perils such as poverty, changing demands for service delivery and related protests. Technological advancements- Events include new means of electronic commerce resulting in increased data availability, IT infrastructure, cost of new technology. (Natural) Environment- Events include floods, fire, earthquakes, resulting in damage to property and loss of human capital and severe impact to communities etc.. Legal- new laws & regulations; responding to legislative changes on time.

Risk Considerations in IDP Planning: How can Risk Assessment improve the IDP? The Risk Assessment process begins with Objectives- What are the threats to the achievement of Organisational Objectives Developing a Risk Profile that speaks to Institutional Analysis as part of IDP Planning What are the risks/ threats to the Economy; the Institution & Communities? Risk Assessment as part of Environmental Scan What are the risks/ threats to the achievement of organisational objectives? Are the Risks identified in the Environmental Scan informing Developmental Priorities? Strategic Objectives/ IDP Funding for Risk Mitigation alongside developmental priorities/ deliverables Budgeting Risk Monitoring- how well are the risks managed in ensuring achivement of objectives SDBIP Has risk mitigation resulted in achievement of objectives and in susainable value in Service Delivery- not once off Performance Reporting

Risk Considerations in IDP Planning: How can the IDP Fail? Identifying what can go wrong in the planning processes which sets the tone for the input, output and outcomes of the IDP; Identifying what can go wrong with the (IDP) Plan itself (Quality of the Plan/ Credibility); Identifying what can go wrong with the implementation of the Plan which supports or strengthens accountability; Understanding the impact of all the above on the following; The People (Citizens)/ Communities & other Stakeholders, The Economy The Institution Does Risk Management enable the institution to anticipate & deal with Worst Case-Scenario if the IDP Fails to achieve its intended purpose?

PARTICIPATORY Does it identify all Key Stakeholders (communities; ward councilors and committees; business; NGOs; Sector Departments; etc.)? Does it give the citizens a voice to speak or is it dictating the terms for development in addressing issues affecting their lives? INTEGRATED Does it align to National and Provincial spheres and various Sectoral Plans Does it optmise available resources at the various spheres for local development Does it promote spatial development principles that support integrated and sustainable development (restructuring of cities and towns) DEVELOPMENTAL Does it address minimum basic services? Does it address poverty and inherited inequalities- mainstreaming the poor into the Economy? Does it promote Economic Development, Social Development & Democracy? REALISTIC AND PROMOTE CONSENSUS WITH ALL STAKEHOLDERS Does it involve all parties and inform them of the institutions strengths & weaknesses; what it can or cant do; etc. What are the things that we do or dont do as the Politcal Leadership And Administration that threaten Public Participation & Democracy in our Planning and day to day interactions?

What are the risks of the IDP not being; Participatory & Inclusive, Integrated, Developmental and Realistic/ Attainable? The municipality should obtain a reasonable understanding of the Risks of the IDP failing and be prepared to respond to the risks adequately and timely.

ROLE OF RISK APPETITE IN IDP: Defining the institutions Risk Appetite- How much risk are we willing to accept as ELM in pursuit of Service Delivery? How much are we willing to lose in Money, Reputation, Service Delivery interruption, Business Disinvestment, People & Skills, due Unemployment, Backlog perpetuation, New Ventures (Risk vs Return) etc.? The risk appetite should guide resource allocation. Risk appetite is defined once the organisation has a broad portfolio view of risks it is facing. Management allocates resources across functional areas (people, systems, resources) with consideration of the Municipalitys risk Appetite and departmental plans for ensuring that objectives are met whilst also responding to the risks. The Institution, once the Environmental Scan and Strategic objectives have been completed, can address how much risk its willing to accept in terms of its Risk Profile, with the aim of achieving objectives in the IDP.

Risk Bearing Capacity (often financial): This is the maximum amount of risk that the organization is able to accept in line with its business mandate without exposing it to collapse (point of no return). How much maximum risk can we be exposed to and still be a going concern/ be solvent or before we run out of business/ shut our doors. Risk Appetite : This is the amount of risk (at a broad level) the organization is willing to accept in line with its strategic objectives. (Set at Council level) Risk Tolerance : This is the maximum amount of risk the organization is willing to take per type or risk. (Set at departmental level) Risk Bearing Capacity Risk Appetite Risk Tolerance

Malicious Compliance- risk not playing a sisgnificant role in Strategic Planning and Operations; One-man Show Risk Officers with inadequate support staff to enable effective risk management (Compromising institutions with compliant yet ineffective Risk Registers)

DEFINITION OF RISK CULTURE Is the set of shared attitudes, values and practices that characterize how an organisation considers risk in its day-to-day activities. It has to be defined and widely communicated. In a typical risk culture, people will do the right things when risks policies and controls are in place; In a good risk culture, people will do the right things when risk policies and controls are not in place; In a bad risk culture, people will not do the right things regardless of policies and controls.

Can Enterprise Wide Risk Management in the municipal environment improve the IDP planning? The Answer is YES. What is the biggest risk to Back-to-Basics? The answer is When we forget who we serve and why serve and think this is just a job!!!

THANK YOU

6 th imfo audit & risk indaba 20-22 april 2015 olive convention centre durban presented by: thoko...

Documents